File name:	2025-06-21_ef5c87ac890b0ee679b0133ea5045fd1_elex_mafia_stealc_tofsee
Full analysis:	https://app.any.run/tasks/605b6e82-705a-4d81-b0a7-b6118c19657a
Verdict:	Malicious activity
Analysis date:	June 21, 2025, 13:00:43
OS:	Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:	EF5C87AC890B0EE679B0133EA5045FD1
SHA1:	382919666B3A68FCB6EBA45055083DD241EAF5DB
SHA256:	F4B8B7791DA9365255A00DCE83F5CA7492D1F081B1BE4469D373F7081D84BD87
SSDEEP:	24576:EsYXjV71C9sVyk7HMZoDIGIoX1pxygJ37Yyzs:EsYXjV5C9sVyk7HMZoDIGIoX1pxyo7Yt

.exe	\|	Win32 Executable MS Visual C++ (generic) (42.2)
.exe	\|	Win64 Executable (generic) (37.3)
.dll	\|	Win32 Dynamic Link Library (generic) (8.8)
.exe	\|	Win32 Executable (generic) (6)
.exe	\|	Generic Win/DOS Executable (2.7)

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2003:11:11 14:39:16+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	10
CodeSize:	140288
InitializedDataSize:	356352
UninitializedDataSize:	-
EntryPoint:	0x113b6
OSVersion:	5.1
ImageVersion:	-
SubsystemVersion:	5.1
Subsystem:	Windows GUI
FileVersionNumber:	12.0.4518.1014
ProductVersionNumber:	12.0.4518.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Windows, Latin1
CompanyName:	Microsoft Corporation
FileDescription:	Microsoft Office Word
FileVersion:	12.0.4518.1014
InternalName:	WinWord
LegalCopyright:	© 2006 Microsoft Corporation. All rights reserved.
LegalTrademarks1:	Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2:	Windows® is a registered trademark of Microsoft Corporation.
OriginalFileName:	WinWord.exe
ProductName:	2007 Microsoft Office system
ProductVersion:	12.0.4518.1014

PID	Process	Filename		Type
1044	6F63.tmp	C:\Users\admin\AppData\Local\Temp\6FC1.tmp		executable
		MD5:28E3394752418745D9E440C3E68B6298	SHA256:4B35C6CCF549974060B7C8C81C6DCE6DBA7280EF8EEEC7734DFDA22EE8B6EAE9
6188	2025-06-21_ef5c87ac890b0ee679b0133ea5045fd1_elex_mafia_stealc_tofsee.exe	C:\Users\admin\AppData\Local\Temp\6EE6.tmp		executable
		MD5:3F9F1FCDF99C41499CD8DB26CFCB64B6	SHA256:5C48545960622EF01DFE372E550FC8B523DBEE710FE60E41052B7D1D2C35F150
6124	6FC1.tmp	C:\Users\admin\AppData\Local\Temp\701F.tmp		executable
		MD5:4D8FDF9B9C4B71B10A8C260AB75D29B8	SHA256:AB0F014BCB92F755D9D66EDB213C7999DD7B42E2E6DCFBAECB7312F123D415C9
5020	6EE6.tmp	C:\Users\admin\AppData\Local\Temp\6F63.tmp		executable
		MD5:DFB67AF5F2FECAE4B82AA1C6CC09A8F6	SHA256:B379422BE0F6483CDD10DBD114F17445C8E269F2837BEDD33549748B11C817F6
6516	7261.tmp	C:\Users\admin\AppData\Local\Temp\72DE.tmp		executable
		MD5:075B19817F4B7E49EE2777708D1E185E	SHA256:54820B83444D355C705F33E05D1E12967EE6FF6DDE3C909D56CB7EFF5DAC28D7
768	707D.tmp	C:\Users\admin\AppData\Local\Temp\70EA.tmp		executable
		MD5:9B34C9F96BF7570F15B501BB10427443	SHA256:DF254F8E402EC748C000C969C47555AD33FED7A86B40330FAF80572B38F36641
2716	70EA.tmp	C:\Users\admin\AppData\Local\Temp\7148.tmp		executable
		MD5:FE5BA9485D971DD4411B3A793AAC0D94	SHA256:1B0B7D3A976ADBEEBE133C0F67BA908299037FC69FAEC4EB7986C3F13EAC83BF
7048	701F.tmp	C:\Users\admin\AppData\Local\Temp\707D.tmp		executable
		MD5:0F56FC86B663CE6A6BDFB7C2B653039D	SHA256:0EB2980631EFC3C6B0146FE0F8640C0E7BB2E06D02AA3C3ACBC28572BC2FAE03
7140	7148.tmp	C:\Users\admin\AppData\Local\Temp\71A5.tmp		executable
		MD5:1A71BCF2026E33DB51D49AF1D6B71F40	SHA256:AC70F5DA6AA06CA1A9415FAA2E91C1F47A941EC6A0833CDC95EA7D15C8728342
4156	71A5.tmp	C:\Users\admin\AppData\Local\Temp\7203.tmp		executable
		MD5:177713BA2A4243749864E1694E506F55	SHA256:30F4FF592D4F1652DE1A69A247D6B7CF0E9FCF9B366AC6D0746B343536BCC2F4

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
5944	MoUsoCoreWorker.exe	GET	200	2.19.11.105:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
1268	svchost.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
1268	svchost.exe	GET	200	2.19.11.105:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
2140	RUXIMICS.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
2140	RUXIMICS.exe	GET	200	2.19.11.105:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
—	—	POST	500	40.91.76.224:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	unknown	xml	512 b	whitelisted
—	—	POST	500	40.91.76.224:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	unknown	xml	512 b	whitelisted

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:137	—	—	—	whitelisted
1268	svchost.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
5944	MoUsoCoreWorker.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
2140	RUXIMICS.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
5944	MoUsoCoreWorker.exe	2.19.11.105:80	crl.microsoft.com	Elisa Oyj	NL	whitelisted
1268	svchost.exe	2.19.11.105:80	crl.microsoft.com	Elisa Oyj	NL	whitelisted
2140	RUXIMICS.exe	2.19.11.105:80	crl.microsoft.com	Elisa Oyj	NL	whitelisted
1268	svchost.exe	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted
5944	MoUsoCoreWorker.exe	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted

Domain	IP	Reputation
settings-win.data.microsoft.com	51.104.136.2 4.231.128.59	whitelisted
google.com	142.250.184.206	whitelisted
crl.microsoft.com	2.19.11.105 2.19.11.120	whitelisted
www.microsoft.com	95.101.149.131	whitelisted
activation-v2.sls.microsoft.com	40.91.76.224	whitelisted
self.events.data.microsoft.com	20.42.65.93	whitelisted

General Info

2025-06-21_ef5c87ac890b0ee679b0133ea5045fd1_elex_mafia_stealc_tofsee

EF5C87AC890B0EE679B0133EA5045FD1

382919666B3A68FCB6EBA45055083DD241EAF5DB

F4B8B7791DA9365255A00DCE83F5CA7492D1F081B1BE4469D373F7081D84BD87

24576:EsYXjV71C9sVyk7HMZoDIGIoX1pxygJ37Yyzs:EsYXjV5C9sVyk7HMZoDIGIoX1pxyo7Yt

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

Process drops legitimate windows executable

Starts a Microsoft application from unusual location

Executable content was dropped or overwritten

Starts itself from another location

Starts application with an unusual extension

INFO

Reads the machine GUID from the registry

Reads the computer name

Checks supported languages

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings